The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches and executes an installation script from the official TruffleSecurity GitHub repository (trufflesecurity/trufflehog) to set up the environment.
[REMOTE_CODE_EXECUTION]: Employs a piped-to-shell pattern (curl | sh) to install the TruffleHog binary directly from its remote source on GitHub.
[COMMAND_EXECUTION]: Utilizes the subprocess module in scripts/agent.py and direct shell commands in SKILL.md to execute trufflehog, git secrets, and aws CLI operations for scanning and credential remediation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external git repositories and file systems, creating a vulnerability surface where malicious content in scanned repositories could influence agent behavior.
Ingestion points: Git repository history, local directory contents, and GitHub organization metadata are processed by scripts/agent.py and the parsing logic in SKILL.md.
Boundary markers: There are no explicit delimiters or warnings used to prevent the agent from interpreting instructions potentially embedded within the discovered secrets or metadata.
Capability inventory: The skill possesses capabilities to read files, execute shell commands, and interact with the AWS IAM API to modify or deactivate access keys.
Sanitization: Metadata and raw secret data extracted from repositories are processed without sanitization before being displayed or used to drive subsequent CLI commands.

detecting-aws-credential-exposure-with-trufflehog